From 433959c280574d40bd2b32750dee8ce73b327586 Mon Sep 17 00:00:00 2001 From: Aman Mittal Date: Sat, 31 Jan 2026 00:41:38 +0530 Subject: [PATCH] FINERACT-2421: Bump - org.apache.tomcat.embed:tomcat-embed-core CVE-2025-61795 --- .../src/main/groovy/org.apache.fineract.dependencies.gradle | 4 ++++ integration-tests/dependencies.gradle | 2 +- oauth2-tests/dependencies.gradle | 2 +- twofactor-tests/dependencies.gradle | 2 +- 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle b/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle index 4e8b5c93f..387ee9a29 100644 --- a/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle +++ b/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle @@ -279,5 +279,9 @@ dependencyManagement { dependency 'io.netty:netty-codec-http:4.1.129.Final' // Force lz4-java version: CVE-2025-12183 dependency 'at.yawk.lz4:lz4-java:1.10.1' + // Force tomcat-embed-core version: CVE-2025-24813 + dependency 'org.apache.tomcat.embed:tomcat-embed-core:10.1.47' + dependency 'org.apache.tomcat.embed:tomcat-embed-el:10.1.47' + dependency 'org.apache.tomcat.embed:tomcat-embed-websocket:10.1.47' } } diff --git a/integration-tests/dependencies.gradle b/integration-tests/dependencies.gradle index 1560d98d3..3e267893f 100644 --- a/integration-tests/dependencies.gradle +++ b/integration-tests/dependencies.gradle @@ -20,7 +20,7 @@ dependencies { // testCompile dependencies are ONLY used in src/test, not src/main. // Do NOT repeat dependencies which are ALREADY in implementation or runtimeOnly! // - tomcat 'org.apache.tomcat:tomcat:10.1.45@zip' + tomcat 'org.apache.tomcat:tomcat:10.1.47@zip' def providerMainOutput = project(':fineract-provider').extensions.getByType(SourceSetContainer).named('main').get().output testImplementation( providerMainOutput, project(path: ':fineract-core', configuration: 'runtimeElements'), diff --git a/oauth2-tests/dependencies.gradle b/oauth2-tests/dependencies.gradle index 168863f06..448003e0b 100644 --- a/oauth2-tests/dependencies.gradle +++ b/oauth2-tests/dependencies.gradle @@ -20,7 +20,7 @@ dependencies { // testCompile dependencies are ONLY used in src/test, not src/main. // Do NOT repeat dependencies which are ALREADY in implementation or runtimeOnly! // - tomcat 'org.apache.tomcat:tomcat:10.1.45@zip' + tomcat 'org.apache.tomcat:tomcat:10.1.47@zip' testImplementation( files("$rootDir/fineract-provider/build/classes/java/main/"), project(path: ':fineract-provider', configuration: 'runtimeElements'), 'org.junit.jupiter:junit-jupiter-api', diff --git a/twofactor-tests/dependencies.gradle b/twofactor-tests/dependencies.gradle index f7b3ed55a..9a5e31684 100644 --- a/twofactor-tests/dependencies.gradle +++ b/twofactor-tests/dependencies.gradle @@ -20,7 +20,7 @@ dependencies { // testCompile dependencies are ONLY used in src/test, not src/main. // Do NOT repeat dependencies which are ALREADY in implementation or runtimeOnly! // - tomcat 'org.apache.tomcat:tomcat:10.1.45@zip' + tomcat 'org.apache.tomcat:tomcat:10.1.47@zip' testImplementation( files("$rootDir/fineract-provider/build/classes/java/main/"), project(path: ':fineract-provider', configuration: 'runtimeElements'), 'org.junit.jupiter:junit-jupiter-api',